debugMinor
How do I fail a gitlab pipeline job?
Viewed 0 times
gitlabfailhowjobpipeline
Problem
I am currently using dependency checker to scan my applications via gitlab
This is how my pipeline looks like.
And this is my output.
```
Executing "step_script" stage of the job script
00:32
$ mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
3304 [INFO] Scanning for projects...
4813 [INFO]
4813 [INFO] -----------------------------------------
4814 [INFO] Building demo 0.0.1-SNAPSHOT
4814 [INFO] --------------------------------[ jar ]---------------------------------
6018 [INFO]
6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
12434 [INFO] Checking for updates
12494 [INFO] Skipping NVD check since last check was within 4 hours.
12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
12499 [INFO] Check for updates complete (64 ms)
12577 [INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.gith
This is how my pipeline looks like.
dependency_scanning:
stage: security_scan
script:
# Run dependency check on all modules
- mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
artifacts:
paths:
- ./target/dependency-check-report.html
only:
- masterAnd this is my output.
```
Executing "step_script" stage of the job script
00:32
$ mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
3304 [INFO] Scanning for projects...
4813 [INFO]
4813 [INFO] -----------------------------------------
4814 [INFO] Building demo 0.0.1-SNAPSHOT
4814 [INFO] --------------------------------[ jar ]---------------------------------
6018 [INFO]
6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
12434 [INFO] Checking for updates
12494 [INFO] Skipping NVD check since last check was within 4 hours.
12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
12499 [INFO] Check for updates complete (64 ms)
12577 [INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
False Positives: https://jeremylong.gith
Solution
All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.
You can do that with the
By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.
You can do that with the
failBuildOnCVSS config flag. E.g. with severity 8 from docs
...
...
...
org.owasp
dependency-check-maven
6.2.2
8
check
...
...
...
By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.
Code Snippets
<project>
...
<build>
...
<plugins>
...
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>6.2.2</version>
<configuration>
<failBuildOnCVSS>8</failBuildOnCVSS>
</configuration>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
...
</plugins>
...
</build>
...
</project>Context
StackExchange DevOps Q#14502, answer score: 2
Revisions (0)
No revisions yet.